Skip to main content
    All AI News
    External (via citation)Tuesday, October 20, 2026 3 min read
    AI

    OpenCode confirms breach as users report AI charges they never authorised

    OpenCode confirmed a security breach after unauthorized access to a legacy system exposed API keys stored in user workspaces, affecting 1.4% of Console users. Attackers used the stolen keys to run unauthorized AI queries across OpenAI, A…

    Key takeaways
    • 01The breach was linked to a large-scale distillation attack aimed at harvesting AI model outputs to train a competing model.
    • 02OpenCode is working with all three AI providers to contain the incident and has notified affected users by email.
    • 03Impacted users are directed to immediately revoke and replace their provider API keys and audit recent usage for unauthorized charges.
    In brief · from notebookcheck.net

    OpenCode confirmed a security breach after unauthorized access to a legacy system exposed API keys stored in user workspaces, affecting 1.4% of Console users. Attackers used the stolen keys to run unauthorized AI queries across OpenAI, Anthropic, and Google accounts, with individual users reporting losses of $400 and €200. The breach was linked to a large-scale distillation attack aimed at harvesting AI model outputs to train a competing model. OpenCode is working with all three AI providers to contain the incident and has notified affected users by email.

    Read the full article at notebookcheck.net

    OpenCode confirmed a security breach after unauthorized access to a legacy system exposed API keys stored in user workspaces, affecting 1.4% of Console users. Attackers used the stolen keys to run unauthorized AI queries across OpenAI, Anthropic, and Google accounts, with individual users reporting losses of $400 and €200. The breach was linked to a large-scale distillation attack aimed at harvesting AI model outputs to train a competing model. OpenCode is working with all three AI providers to contain the incident and has notified affected users by email. Impacted users are directed to immediately revoke and replace their provider API keys and audit recent usage for unauthorized charges.

    Don't miss tomorrow's

    The Daily Pulse in your inbox each morning — sourced and linked.

    How often
    Keep going — across the app